The present invention relates in general to cryptography and secure communication via computer networks or via other types of systems and devices, and more particularly to the determination and use of a shared secret in an identity-based cryptosystem, for instance, to encode and decode communication between two entities without the disadvantage of key escrow.
Identity-based cryptosystems are public key cryptosystems in which the public key of an entity is derived from its identity (name, address, email address, IP address, etc.). An entity's private key is generated and distributed by a trusted party. The trusted party uses a master secret to generated the private keys.
Protocols exist for two entities to agree upon a shared secret for encryption or authentication of communication between them. In identity-based key agreement protocols, each party typically constructs the shared secret by using its own private key and the other party's public identity. For instance, supersingular elliptic curves and associated pairings have been used to construct relatively secure identity-based signature and key agreement protocols. In addition, more efficient protocols have been developed using supersingular abelian varieties in place of elliptic curves. Because the shared secret is based in part upon the other party's private key, authentication may be provided indirectly by the trusted authority.
Existing identity-based cryptosystems have been limited, however, because they have involved key escrow. The trusted authority knows all secrets in the cryptosystem because it knows the private keys of all parties. As a result, existing identity-based cryptosystems have been vulnerable to passive attacks in which the shared secret used by the two parties can be determined by the trusted authority, or by any other party that discovers the master secret.
Accordingly, there is a need for a secure identity-based key agreement protocol without the disadvantage of key escrow. It therefore is an object of the present invention to provide a secure, authenticated identity-based cryptosystem including key agreement protocols that do not require key escrow. It is a further object of the present invention to provide a key agreement protocol that is secure against a passive attack based on interception of messages between two communicating parties.